CVE-2026-107797
Jivejdon through 5.0 contains a reflected cross-site scripting vulnerability in application/message/postThread.jsp that allows attackers to
CVSS
6.1
Média
EPSS
0.2%
p16
KEV
—
Exploit Today
5
0-100
Publicado: 8 de out. de 2026 · Última mod.: 9 de out. de 2026 · CWE-79
0.2%EPSS · 30 dias0.2%
2026-10-092026-11-05
Jivejdon through 5.0 contains a reflected cross-site scripting vulnerability in application/message/postThread.jsp that allows attackers to inject script via the to and tag parameters. Attackers can send crafted links to authenticated users, breaking out of unencoded inline JavaScript string literals to execute arbitrary JavaScript in the victim's session.
- github.comhttps://github.com/banq/jivejdon
- github.comhttps://github.com/banq/jivejdon/blob/ee67a65e65228644a71c8317d7e34deea50f95ef/application/message/postThread.jsp#L54-L72
- github.comhttps://github.com/banq/jivejdon/issues/28
- www.vulncheck.comhttps://www.vulncheck.com/advisories/jivejdon-through-5.0-reflected-xss-via-postthread-jsp-to-and-tag-parameters
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-650226.3 MÉD—
———The MDM App Catalog / App Store preview does not properly sanitize or encode user-supplied HTML before rendering it. Injected HTML can be displayed to users who view the preview, which may allow cross-site scripting (XSS) when a user interacts with the crafted content.6hCVE-2026-397447.1 ALT—
———Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WC Lovers WCFM Membership wc-multivendor-membership allows Stored XSS.This issue affects WCFM Membership: from n/a through 2.12.0.6hCVE-2026-1194887.1 ALT—
———Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shamim Rajani Pie Register pie-register allows Stored XSS.This issue affects Pie Register: from n/a through 3.8.4.15.6hCVE-2026-1194726.5 MÉD—
———Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Anderson Redux Framework redux-framework allows Stored XSS.This issue affects Redux Framework: from n/a through 4.5.16.6hCVE-2026-1194328.7 ALT—
———A stored cross-site scripting (XSS) vulnerability exists in the Foxit Workspace's file share preview functionality. An attacker could upload a crafted file and share it with a victim. When the victim opens or previews the file, the embedded script executes in the application's origin, potentially accessing locally stored credentials and enabling credential theft.9hCVE-2026-889866.1 MÉD—
———Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.15.0, the frontend routes /pipeline/k8s/pod and /pipeline/k8s/pod/events use frontend/server/k8s-helper.ts to include untrusted podname and podnamespace query values and backend error details in HTML-capable error responses. An unauthenticated attacker can craft a link that executes JavaScript in the frontend origin when a user who satisfies the deployment's authentication and route-access requirements follows it and reaches an affected response. Cookie disclosure depends on cookie attributes, and server-side code execution or availability impact is not established. This issue is fixed in version 2.15.0.16h